cve.nowby Sazabi

GoPackage

github.com/devtron-labs/devtron

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Latest release: v1.8.2 (Oct 1, 2025): affected by CVE-2026-25538
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 2 · 2 high

Releases: 165 since v0.2.4 (Mar 15, 2021)
Registry: pkg.go.dev
Releases read: Nov 8, 2026

Version timeline

CVE-2026-25538
Affects v0.2.4 to v1.8.2 (through the newest release)
CVE-2024-45794
Affects v0.2.4 to v0.7.2-rc.0 (v0.7.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 2

CVE-2026-25538High 8.7
Devtron Attributes API Unauthorized Access Leading to API Token Signing Key Leakage
Affected: through 2.0.0; all versions.
No fix released. The latest release, v1.8.2, is still affected.
CVE-2024-45794High 8.3
SQL Injection in CreateUser API in devtron
Affected: fixed in 0.7.2.
Fixed in v0.7.2 (released Aug 26, 2024, 73 days before disclosure).
The latest release, v1.8.2, is not affected.